Spectra Gutenberg Blocks CVE-2026-7465: Brief Summary of a Contributor-Level RCE via Block Callback Injection

Introduction

A single line of PHP in a WordPress plugin installed on over one million websites was quietly passing user-controlled data into a block type registration call. That let any Contributor-level user register an arbitrary PHP function as a rendering callback, then trigger its execution in the same page request. CVE-2026-7465 is a CVSS 8.8 Remote Code Execution vulnerability in the Spectra Gutenberg Blocks plugin (formerly Ultimate Addons for Gutenberg) by Brainstorm Force. Its two-stage exploitation through the Gutenberg block rendering pipeline is what makes it both architecturally interesting and practically dangerous.

Spectra Gutenberg Blocks is a WordPress plugin that extends the native block editor with extra design and layout blocks. It has over 1,000,000 active installations and a 4.7-star rating from nearly 1,900 reviews, which makes it one of the most widely deployed block editor extensions in the WordPress ecosystem. The plugin is developed by Brainstorm Force, a Pune-based company with over 130 team members whose products, including the Astra theme, run on millions of WordPress sites.

Technical Information

Root Cause

The vulnerability lives in the render_block() method of classes/class-uagb-init-blocks.php, around lines 330 and 335 of the vulnerable version (2.19.25). This method hooks into WordPress's render_block filter and fires on every block rendered on the frontend.

To support WordPress 6.9's "Hide Blocks" feature, the Spectra plugin added logic to dynamically register any uagb/ prefixed block type that was not already present in the WP_Block_Type_Registry. The problem was in how it did that registration. At line 335 of the vulnerable version, the code ran:

$registry->register( $block['blockName'], $block['attrs'] );

The $block['attrs'] array is parsed directly from serialized post content. In WordPress, any user with Contributor-level access or above can author post content. WordPress's register_block_type() function accepts a render_callback key inside its arguments array. If that key is present, the callable is stored in the block type registry and later invoked via call_user_func() whenever a block of that type is rendered.

Because $block['attrs'] was passed wholesale to the registration function, an attacker could embed a render_callback key pointing to any arbitrary PHP function (such as system, exec, or passthru) in the block attributes of a crafted uagb/ prefixed block.

Attack Flow

The exploit runs in two stages within a single page request:

Stage 1: Malicious Block Registration. The attacker creates a post containing a first block with a fabricated block type name using the uagb/ prefix (for example, uagb/evil). This block's attributes include a render_callback key pointing to an attacker-chosen PHP function. When the Spectra plugin's render_block() method encounters this block, it checks the WP_Block_Type_Registry, finds that uagb/evil is not registered, and calls $registry->register( 'uagb/evil', $block['attrs'] ). The malicious render_callback is now stored in the block type registry.

Stage 2: Callback Invocation. A second block of the same fake type (uagb/evil) is embedded in the same post content. When WordPress's sequential block rendering pipeline reaches this second block, the block type is already registered from Stage 1. WordPress core's render_block_data pipeline invokes the registered render_callback via call_user_func(), executing whatever PHP function the attacker specified.

This two-block design is worth noting because it separates the malicious callback registration from its invocation. Each block on its own may look benign. The exploit only fires when both blocks are processed in sequence during the same rendering cycle.

Attack Vector Summary

One nuance matters here. The Contributor role in WordPress is the second-lowest user role, above Subscriber. Contributors can create and edit their own posts but cannot publish them. The exploit payload lives in post content, though, and even saving a draft can trigger the block registration and rendering pipeline when the post is previewed or reviewed by an editor. So a Contributor can weaponize a draft post without any publish permissions.

Discovery Credit

The vulnerability was discovered by security researcher kai63001 (Supanat Konprom) and reported through Wordfence's vulnerability disclosure program.

Patch Information

The Spectra development team shipped the fix in version 2.19.26, released on May 4, 2026. The patch is a single targeted line change inside the render_block() method of classes/class-uagb-init-blocks.php.

In the vulnerable version (2.19.25 and earlier), the registration call at line 335 was:

$registry->register( $block['blockName'], $block['attrs'] );

In the patched version (2.19.26), this became:

$registry->register( $block['blockName'], array() );

Replacing $block['attrs'] with an empty array() means no user-controlled data reaches the block type registration. The block is still registered as a stub, which satisfies the WordPress 6.9 compatibility requirement for the "Hide Blocks" feature, but it carries no render_callback, no attacker-specified arguments, and nothing exploitable. This one line severs the trust chain between user-authored content and PHP callable registration.

The plugin changelog for version 2.19.26 confirms it: "This update addressed a security bug. Props to Wordfence for reporting it responsibly." The latest available version at the time of disclosure is 2.19.28. Site administrators should update to 2.19.26 or later immediately.

The vulnerable and patched source files can be compared directly:

• Vulnerable version (2.19.25)
• Patched version (2.19.26)

Compensating Controls

If an immediate update is not feasible, these measures can reduce risk:

• Restrict Contributor and Author roles: Exploitation requires Contributor-level access or above, so limiting the number of users with posting privileges directly reduces the attack surface. Audit all user accounts and remove or downgrade any that are not essential.
• Deploy WAF rules: Configure rules to inspect incoming post content for suspicious uagb/ prefixed block registrations that include render_callback attributes referencing non-standard PHP functions. Wordfence Premium can provide virtual patching rules for this vulnerability.
• Search for existing payloads: Query the WordPress database for post content containing uagb/ prefixed block types with unusual render_callback attributes to find previously inserted exploit payloads.
• Temporarily deactivate the plugin: If Spectra is not critical to the site, deactivating it entirely removes the attack vector until a patched version can be installed.

Affected Systems and Versions

All versions of the Spectra Gutenberg Blocks plugin (also known as Ultimate Addons for Gutenberg) up to and including version 2.19.25 are vulnerable. That covers every release from its initial availability on June 13, 2018 through the vulnerable version.

The vulnerability is exploitable on any WordPress installation where:

• The Spectra Gutenberg Blocks plugin is installed and active at version 2.19.25 or below
• At least one user account exists with Contributor-level access or higher

Version 2.19.26 and later are not affected.

Vendor Security History

Brainstorm Force has a documented pattern of security vulnerabilities in the Spectra plugin. Multiple CVEs have been assigned across 2024 through 2026:

The plugin's changelog shows five security-related patches in about eight months:

The recurrence of privilege management failures (CWE-269 for this CVE, alongside multiple Missing Authorization CVEs) points to a structural weakness in how the plugin validates permissions and callbacks, rather than isolated coding errors. Brainstorm Force has been responsive in issuing patches, but the frequency of discoveries by independent researchers suggests the plugin's security architecture would benefit from a thorough audit. Organizations should weigh whether to keep relying on this plugin for production sites, or restrict it to trusted editor-only environments.

References

• Wordfence Advisory: Spectra Gutenberg Blocks <= 2.19.25 RCE
• NVD: CVE-2026-7465 Detail
• CVE Record: CVE-2026-7465
• Vulnerable Source: class-uagb-init-blocks.php (2.19.25)
• Patched Source: class-uagb-init-blocks.php (2.19.26)
• WordPress Plugin Page: Spectra Gutenberg Blocks (Changelog)
• WordPress Trac: Vulnerable Code at Line 330
• WordPress Trac: Vulnerable Code at Line 335
• WordPress Trac: Patched Code at Line 330 (trunk)
• WordPress Trac: Patched Code at Line 335 (trunk)
• Wordfence: Spectra Plugin Vulnerability History
• Patchstack: Spectra Plugin Information Disclosure
• Brainstorm Force: About
• Brainstorm Force: Products